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ACT ON ALGORITHMS AND ARTIFICIAL INTELLIGENCE [13509] 
COMMENTS FROM BSA | THE SOFTWARE ALLIANCE 


BSA | The Software Alliance (BSA) would like to express our gratitude to Lawmaker Yoon Young- 
chan’s office and the National Assembly’s Science, ICT, Broadcasting, and Communications 
Committee (SIBCC) for giving us an opportunity to deliver our position on the Bill for the Act on 
Algorithms and Artificial Intelligence (Draft No. 13509) (the Bill). 


BSA is the leading advocate for the global software industry before governments and in the 
international marketplace. Our members’ are at the forefront of software-enabled innovation that is 
fueling global economic growth, including cloud computing, data analytics, and artificial intelligence 
(Al) products and services. As leaders in the development of cutting-edge technology, BSA’s 
members have unique insights into both the tremendous potential of these new technologies and the 
government policies that can best support their responsible use and ensure continued innovation of 
such technologies. 


We are encouraged that the Bill seeks to build public confidence in Al by promoting the benefits of Al 
and implementing safeguards for high-risk Al. Al has the potential to generate substantial economic 
growth and enable governments to provide better and more responsive government services, while 
addressing some of the most pressing societal challenges. In this regard, we provide the following 
recommendations to the Bill: 


Recognize different responsibilities of “Al Developing Businesses” and “Al 
Service Providers” 


Al regulations should allocate responsibilities in a manner that corresponds to the capabilities 
of the stakeholders that may be involved in the development (i.e., Al Developing Businesses), 
deployment and use (i.e., Al Service Providers) of Al systems. The Organization for Economic 
Co-operation and Development (OECD) recognized the critical importance of distinguishing the 
multiple stakeholders involved in Al when it adopted the principles underlying the Recommendation of 
Council on Artificial Intelligence (Recommendation).’ Specifically, the Recommendation recognizes 
that effective Al policies must necessarily account for “stakeholders according to their role and the 
context” in which Al is being deployed. Distinguishing the developer of an Al solution, or of part of an 





1 BSA’s members include: Adobe, Alteryx, Altium, Amazon Web Services, Atlassian, Autodesk, Aveva, Bentley Systems, Box, 
Cisco, CNC/Mastercam, Dassault, DocuSign, Dropbox, IBM, Informatica, Intel, MathWorks, Microsoft, Nikon, Okta, Oracle, 
PTC, Rockwell, Salesforce, SAP, ServiceNow, Shopify Inc., Siemens Industry Software Inc., Splunk, Trend Micro, Trimble 
Solutions Corporation, Twilio, Unity Technologies, Inc., Workday, Zendesk, and Zoom Video Communications, Inc. 


2 Recommendation of the Council on Artificial Intelligence, May 2019, https://legalinstruments.oecd.org/en/instruments/OECD- 
LEGAL-0449. Per the Recommendation, the Al stakeholder community “encompasses all organizations and individuals 
involved in, or affected by, Al systems, directly or indirectly.” 
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Al solution, from the deployer of said Al solution would be helpful to both entities as they carry out risk 
assessments to determine the appropriate measures to adopt for Al development, deployment and 
use. Relatedly, any obligation (and associated liabilities) should fall on the entity with the closest 
nexus to the user of the Al service, as such entity would be best positioned to both identify and 
efficiently mitigate the risk of harm that gave rise to the need for a regulation. 


The Bill draws a similar distinction between Al Developing Businesses (entities engaged in economic 
activities related to the development of algorithms and Al), and Al Service Providers (entities which 
provide services to users using algorithms and Al). However, some articles in the Bill, such as Articles 
5 and 19, do not clearly allocate the responsibilities of these different stakeholders. This is potentially 
problematic as Al Developing Businesses, unlike Al Service Providers, generally will not have access 
to the input data that was used by the Al systems to render a decision, and therefore cannot properly 
fulfill user-facing obligations (e.g., responding to user requests for more information under Article 19). 
Furthermore, an Al Developing Business might provide only a part of an Al solution or a general 
purpose (part of) an Al solution. On the other hand, there are also circumstances in which an Al 
Developing Business and Al Service Provider are the same entity. For instance, if a company 
develops an in-house Al system and proceeds to deploy it in the course of its business operations, it 
is both an Al Developing Business and Al Service Provider. 


In light of the above considerations, as a matter of general practice, BSA urges the 
Lawmaker’s office and the SIBCC to: 1) consider, when setting out obligations in the Bill, 
whether an Al Developing Business or Al Service Provider is best placed to discharge the 
obligation; and 2) clearly state in the provisions which entity the obligation would apply to. 


BSA also recommends making clear in the definition of “Al Service Provider” that there are 
circumstances where an Al Developing Business may also be an Al Service Provider, and 
therefore be subject to the same obligations, if it provides a service directly to users using the 
Al system that it developed in-house. 


Align definition of Al with the OECD 





Original Suggestion 





Article 2 (Definition) Article 2 (Definition) 


(2) The term “artificial intelligence or Al” refers to | (2) The term “artificial intelligence or Al” refers to 
the intellectual abilities of human beings fheintedectual asiiies oF human sengs 
implemented, including learning, reasoning, ; = } HG HE 
perception, judgment, and understanding of perception-judgment-andunderstanding-of 
natural language, in an electronic means. naturalanguageinan electronic means a 
machine-based system that can, for a given set 
of human-defined objectives, make predictions, 


recommendations, or decisions influencing real 
or virtual environments. 








Explanation: 


Al systems are developed and deployed in an international context. It follows that the regulations 
and standard that apply to Al and ADM should operate across different jurisdictions, to facilitate 
and promote further adoption and use of Al technologies. 
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In this regard, we propose using the OECD’s definition of Al. In its Recommendation, the OECD 
defines Al as “a machine-based system that can, for a given set of human-defined objectives, make 
predictions, recommendations, or decisions influencing real or virtual environments”. This definition 
has been referenced by regulators worldwide, including the European Union.? Using a recognized 
and international definition, such as the OECD’s, could facilitate international alignment, dialogue, 
adoption and compliance. 











Definition of high-risk Al should be more specific 





Original Suggestion 





Article 2 (Definitions) Article 2 (Definitions) 


(3) The term “high-risk Al” means Al that falls (3) The term “high-risk Al” means Al that: _(i) falls 
under any of the following items, which has a under any of the following items,; and (ii) whieh 





significant impact on the public life, physical has-poses a direct, substantial risk of harm to 
safety, and protection of basic rights. significantimpacten_the public-life or, physical 


safety of individuals, or to and protection -of the 
basic rights guaranteed to citizens of the 
Republic of Korea. 








Explanation: 


To make the policy intention clearer, we propose stating specifically that high-risk Al refers 
to Al that is used in a manner that poses a substantial risk of “harm” to a person’s life, 
health, safety, or basic rights. BSA also notes that the requirements for determining what is high- 
risk Al should apply cumulatively i.e., the Al must: (a) harm a person’s safety/infringe on basic 
rights; AND (b) fall within a specific category to be deemed “high-risk”. This avoids situations where 
low-risk Al (e.g., payroll processing Al) that are used in “high-risk” industries (e.g., major 
infrastructure) are categorized as “high-risk Al” by default. 


Separately, we are also concerned that the instances of high-risk Al in Article 2(3) are overly 
broad and vague. In particular, “Al associated with human life” could refer to a wide range of 
matters, ranging from Al used in human resource management to Al used in healthcare. We 
recommend refraining from using broad, “catch-all” provisions such as this, as it generates 
significant regulatory uncertainty. 





Clarify the definition of “users” 








Original Suggestion 

















3 The European Union's draft Artificial Intelligence Act currently defines “artificial intelligence system” as “software that ... can, 
for a given set of human-defined objectives, generate outputs such as content, predictions, recommendations, or decisions 
influencing the environments they interact with’. 
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Article 2 (Definitions) 


(6) The term “user” means a person who is 
provided with a technology or service from Al 
service provider. 





Article 2 (Definitions) 


(6) The term “user” means a person who is 
provided with a technology or service from an Al 
service provider, and who uses the technology 
or service as the final user of the technology or 
service and not as an input to a product or 
service that the person provides to another 
person. 





Explanation: 


substantive requirements. 





The existing definition of “user” leaves open the possibility that that user itself could be considered 
an “Al Service Provider”. The proposed edits to the definition seek to ensure that “users” are 
not also considered to be “Al Service Providers”. Otherwise, this would result in tremendous 
uncertainty for all entities in the Al technology and service ecosystem, particularly “Al Service 
Providers” and “users”, as to which entity will need to be responsible for complying with the Bill’s 





Establish mechanisms for redress and stipulate the relief available under such 


mechanisms 





Original 


Suggestion 





Article 5 (Basic Principles of Algorithm and 
Artificial Intelligence Development) 


(3) Al Developing Businesses and Al Service 
providers must fairly ensure the rights of users 
throughout the process of developing and using 
algorithms and Al and must actively provide aid 
in the event that causes damage to users. 





Article 5 (Basic Principles of Algorithm and 
Artificial Intelligence Development) 


(3) Al developing businesses-and An Al Service 
Providers that uses high risk Al to provide 
services to users should mustHfairly ensure the 
rights-of users throughout the process of 

3 9 : ik o 
causes-damage+o-users-establish accessible 
mechanisms for redress in case of any harm or 
adverse impact arising from decisions made by 
the Al service provider's Al systems. 


(4) The relief available under the redress 
mechanisms in Paragraph (3) shall be 
rescribed by the Presidential Decree. 





Explanation: 


accessible mechanisms for redress. 
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BSA further recommends that the responsibility of responding to user requests should lie 
with the Al Service Providers. Al Service Providers are the entities that interact directly with 
users, and as such are best placed to provide redress to aggrieved users. It should also be noted 
that if an Al Developing Business provides a service directly to users using the Al system that it 
developed in-house, it should also be considered an “Al Service Provider” in this context and is 
therefore obliged to provide a redress mechanism for users. 


To provide further guidance for businesses, BSA also suggests that the relief available under 
redress mechanisms should be prescribed by Presidential Decree. 








Remove the obligation to compensate users 








Original Suggestion 
Article 6 (Basic Duties for Al Developing Article 6 (Basic Duties for Al Developing 
Business and Al Service Providers) Businesses and Al Service Providers) 
(2) Al developing business and Al service (A) Al dove.caing business ang Al cence 
providers must take measures to protect and providers must take measures to orotect and 
compensate users compensate users 








Explanation: 


BSA proposes to delete Article 6(2). While we acknowledge that redress mechanisms should be 
in place to assist users of Al, we do not support providing users with the right to seek financial 
restitution when the circumstances for compensation are not clearly set out. In the case of Article 
6(2), it is not clear what the users will be compensated for. Furthermore, the creation of new Al 
liability rules may not be necessary — existing tort law principles are technology-neutral and 
sufficient, and the introduction of new Al liability rules may lead to legal uncertainty and 
inconsistencies with existing laws. 











Remove requirements for Al Ethics Committee to conduct annual 
investigations and draw up internal compliance report 























Original Suggestion 

Article 6 (Basic Duties for Al Developing Article 6 (Basic Principles for Al Developing 
Business and Al service providers) Business and Al Service Providers) 
(4) Al developing business and service (4) Al developing business and service 
providers larger than the size prescribed by the | providers larger than the size prescribed by the 
presidential decree should internally have an presidential decree should internally have an 
Algorithm and Al Ethics Committee to comply Algorithm and Al Ethics Committee to comply 
with the basic principles of algorithm and Al with the basic principles of ethical algorithm and 
technology development. Al technology development. 
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(5) The Algorithm and Al Ethics Committee (E The Algeriaessed ALohss Gomese 
under paragraph 4 may annually investigate the | uaderparagraph4_mayannualhinvestigate the 
composition of algorithms and the ethical validity | compesition ctalgerithms-and the ethical validity 
of Al technology and draw up a compliance of AHechnology and periodically draw up-an 
report accordingly. internal compliance report accordingly. 





Explanation: 


BSA proposes to delete Article 6(5). Paragraph (4) already states the purpose of the Algorithm 
and Al Ethics Committee, which is to ensure compliance with ethical Al principles. For that 
purpose, ethical Al committees typically review Al projects as early as project inception, and 
through its lifecycle. Performing an investigation annually will not serve the Committee’s purpose. It 
is also unclear what the purpose of the annual compliance report would be, who it would be 
released to, and to what effect. 











Align “technical standards” with international standards 


Articles 8 and 9 of the Bill allows the Minister of Science and ICT to establish “technical standards” to 
“secure the stability, reliability, and interoperability of algorithms and Al technology”. Al systems are 
developed and deployed in an international context. It follows that Al regulations and standards 
should ideally operate across different jurisdictions to facilitate and promote further adoption and use 
of Al technologies. 


BSA urges that, in designing technical standards for Al, the Government should align them 
with internationally recognized standards, as opposed to developing a standalone, national 
standard. In addition to promoting trust, confidence, and marketplace efficiencies, internationally 
recognized standards have the added benefit of mitigating the risks that can accompany country- 
specific standards. The proliferation of national standards can undermine global commerce and stunt 
the development of technology in two related ways. First, it can give rise to a patchwork of 
inconsistent national standards that act as an unintentional barrier to international trade, making it 
more costly for companies to develop and sell their Al-related products and services to the global 
marketplace. Second, national standards can also serve as overt barriers to trade when they are 
manipulated to create unfair advantages for national firms, including with respect to participation by 
foreign firms. 


In this regard, BSA is encouraged to see a reference to the International Organization of 
Standardization (ISO) in Article 9(3).4 The ISO’s Standards Committee on Artificial Intelligence? has 
completed work on 10 sets of standards, including on bias in Al systems and approaches to enhance 
trustworthiness in Al, and is currently developing 27 additional standards. BSA strongly 
encourages leveraging and supporting ISO’s work in this regard and cautions against the 
development of a Korea-specific standard. 





4 Article 9(3) reads: The Minister of Science and ICT must maintain and strengthen the standardization of algorithms and Al 
technology or the cooperation system with the International Organization for Standardization. 


5 See ISO/IEC JTC 1/SC 42 at https://www.iso.org/committee/6794475.htm. 


ê See ISO/IEC TR 24027: 2021 (Bias in Al systems and Al aided decision making) at 
https://www.iso.org/standard/77607.html?browse=tc and ISO/IEC TR 24028:2020 (Overview of trustworthiness in artificial 
intelligence) at https://www.iso.org/standard/77608.html?browse=tc. 
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Support copyright exception to facilitate Al innovation 





Original 


Suggestion 





Article 14 (Replication and Transmission for 
Information Analysis) 


(1) Works can be replicated and transmitted 
within the necessary limits when it is intended to 


Article 14 (Replication and Transmission for 
Information Analysis) 


(1) Works subject to copyright protection can be 
replicated reproduced and transmitted within the 


generate additional information or value by 
collecting and analysing (extracting or learning 
information such as rules, structures, 
tendencies, correlations, etc.) a large amount of 
information including myriad works using 
computers, etc., without possessing the 
thoughts or emotions expressed in the work. 


necessartimits when for the purposes of 
performing a computational analysis that it is 
intended to generate additional information or 
value by collecting and analysing (extracting or 
learning information such as rules, structures, 
tendencies, correlations, etc.) a large amount of 
information including myriad works using 
computers, etc., without possessing the 
thoughts or emotions expressed in the work. 








BSA is strongly supportive of this exception. We agree that the Copyright Act should be 
updated to account for technological transformations and ensure that Korean business are well- 
positioned to leverage Al. Implementing a specific copyright exception for reproductions created as 
part of the machine learning process (e.g., to create a corpus of training data for the Al system) 
would provide greater legal certainty and encourage Al innovation. 


There is also an emerging international norm to provide explicit copyright exceptions for “text-and- 
data mining” (EU), “data analysis” (Japan), or “computational data analysis” (Singapore): 


e EU- “Data Mining”: In April 2019, the European Council formally adopted the Directive 
on Copyright and Related Rights in the Digital Single Market.’ Articles 3 and 4 of the 
Directive create two broad exceptions that authorize Al researchers to make reproductions 
that are needed for the purposes of carrying out “any automated analytical technique aimed 
at analysing text and data in digital form in order to generate information which includes but 
is not limited to patterns, trends and correlations.” Importantly, the Directive clarifies that 
Articles 3 and 4 are without prejudice to existing exceptions and limitations that may 
already allow for reproductions that are necessary for machine learning.” 


e Japan - “Data Analysis”: In May 2018, the Diet passed the Copyright Law Amendment 
Act, allowing users to “exploit” any copyrighted work for non-consumptive purposes, 
including for “data analysis (meaning the extraction, comparison, classification, or other 
statistical analysis of the constituent language, sound, or image data)” and “computer data 
processing”.® 


e Singapore — “Computational Data Analysis”: In September 2021, Singapore updated its 
Copyright Act to include an exception for “computational data analysis”, which covers 
reproductions that are necessary for the purpose of performing a computational data 
analysis and communications to the public that are necessary for the purposes of: (i) 














7 Directive on Copyright and Related Rights in the Digital Single Market, April 2019, https://eur-lex.europa.eu/eli/dir/2019/790/oj. 





8 Copyright Law of Japan, Article 30-4, https://www.cric.or.jp/english/clj/ocl.html. 
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verifying the results of the computational data analysis or (ii) collaborative research and 
study relating to the purpose of the computational data analysis. ° 


Regardless of the chosen terminology, we agree that the Korean Copyright Act should 
provide legal certainty to support Al innovation and support the inclusion of Article 14 to 
implement a copyright exception. 











Provide more details on duties of high-risk Al Developing Businesses 


Article 17 sets out the additional duties for high-risk Al Developing Businesses. BSA recommends 
further elaboration on these duties, including the following: 


e Article 17(1)(1) requires high-risk Al Developing Businesses to establish a “risk management 
system”. It is unclear what a “risk management system” is, given that no further details are 
provided. We urge the Lawmaker’s office and SIBCC to provide details and guidelines 
on the contents of this risk management system to assist high-risk Al Developing 
Businesses in discharging their obligations. 


e Article 17(1)(4) requires high-risk Al Developing Businesses to “provide information on high- 
risk Al users”. However, Al Developing Businesses that license their Al for use by third parties 
(i.e., Al Service Providers) do not interact with users directly and as such are unlikely to have 
information on particular users. BSA recommends removing this obligation. 


e Article 17(1)(5) requires high-risk Al Developing Businesses to “manage and supervise high- 
risk Al by man”. BSA recommends providing additional guidance on: 1) what is the 
appropriate level of supervision; and 2) whether the issue of supervision should be 
covered in the “risk management system” in Article 17(1)(1). 


e Article 17(1)(6) requires high-risk Al Developing Businesses to “strengthen cybersecurity” 
when developing high-risk Al. This presumes that the high-risk Al Developing Businesses do 
not have inadequate cybersecurity measures in place, which is not necessarily the case. BSA 
recommends providing more details on the required/adequate level of cybersecurity 
for high-risk Al Developing Businesses. 


e Articles 17(2) and 17(3) require high-risk Al Developing Businesses to “inform users and 
relevant stakeholders of the operating principles of Al algorithms”, and to “notify users that the 
work is handled by Al”. As highlighted above, regulations should allocate responsibilities in a 
manner that corresponds to the capabilities of the stakeholders. Al Developing Businesses do 
not interact with users directly and are unlikely to have visibility into who are the users of their 
systems. Further, given that Al Service Providers are similarly required to inform users that 
the services they are using are provided by Al systems (see Article 18(4)), this can lead to 
duplication of notification. In the circumstances, BSA recommends removing obligations 
that require Al Developing Businesses to inform or notify users. 


Obligation to respond to users should extend only to high-risk Al Service 
Providers and be subject to exceptions 





° Copyright Act 2021 of Singapore, Sections 243-244, https://sso.agc.gov.sg/Acts-Supp/22-2021/Published/ 
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Original 


Suggestion 





Article 19 (Protection of high-risk Al user) 


(1) Users of High-risk Al have the following 
prescribed rights. 


1. Right to request explanation of a 
technology or service that use high-risk 
Al; and 


2. Right to veto or object to technologies 
or services that use high-risk Al. 


(2) High-risk Al users may request data from the 
business operator to confirm whether there has 
been unfair treatment according to the 
algorithm. 


(3) A High-risk Al business operator (Refers 
to both High-risk Al developing business 
and service provider) who receives a request 
under paragraph (2) shall handle it after 
deliberation by the Algorithm and Ethics 
Committee under Article 6(4) unless otherwise 
specified or justifiable in other laws; if the 
Algorithm and Artificial Intelligence Ethics 
Committee under Article 6(4) refuses to submit 
data, it may request for a review by the Review 
Committee to review the submission of data. 


(4) Users should be provided with the 
information that the services provided are 
processed according to the algorithm. In this 
case, the user has the authority to refuse the 
process. 





Article 19 (Protection of high-risk Al user) 


(1) Users of the services of a High-risk Al 
Service Provider have the following prescribed 
rights. 


1. Right to request that the High-risk Al 
Service Provider provide an explanation 
of the basis of a decision rendered by 
the etechroliccy opsemiceieaiuse 
high-risk Al. 


2. Right to request reconsideration from 
the High-risk Al Service Provider of the 
adverse decision rendered by the vete 


orobjectte technologies-orsemices 
thatuse high-risk Al. 


3.(2) High-riskAl users may Right to 
request data from the High-risk Al 
Service Provider business-operaters_to 
confirm whether there has been unfair 
treatment according to the algorithms 


(2) A High-risk Al Service Provider is exempt 
from the requirements in Paragraph (1) to 
provide an explanation or data to the user of 
High-risk Al in the following cases: 


1. When providing an explanation or 
data to the user may harm another 
person’s life and/or physical safety or 
violate the basic rights that are 


quaranteed to citizens of the Republic of 
Korea. 


2. When providing an explanation or 
data to the user would lead to the High- 
risk Al Service Provider breaching its 
obligations under the Unfair Competition 
Prevention and Trade Secret Protection 


Act or under any other legislation. 


3. When providing an explanation or 
data to the user would lead to the High- 
risk Al Service Provider revealing 
sensitive or proprietary information 
about its operations. 


(3) A High-risk Al Service Providerbusiness 
tor (Ref o both High-risk Al 
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who receives a request under paragraph (21) 
subparagraph 3 shall handle it after deliberation 
by the Algorithm and Ethics Committee under 
Article 6(4) unless otherwise specified or 
justifiable in other laws; if the Algorithm and 
Artificial Intelligence Ethics Committee under 
Article 6(4) refuses to provide thesubmit data_to 
the user in question, it may request for a review 
by the Review Committee to review the 
provisionsupmissien of data. 


(4) A High-risk Al Service Provider should also 
notify its Yusers should be provided with the 

information that theits services are provided 
using High-risk Al are-precessed according to 

the-algerithm. In this case, the user has the 


authority to refuse the process. 








Explanation: 


Article 19 of the Bill sets out the rights of users to request explanations of and raise objections to 
the use of high-risk Al. The wording of Article 19 suggests that the responsibility to respond to 
users lies on both Al Service Providers and Al Developing Businesses. This is problematic as Al 
Developing Businesses generally will not have access to the data that was used by the Al systems 
to render a decision, and therefore would not be able to explain the results of the Al decision to the 
aggrieved user. BSA therefore recommends that the responsibility of responding to user 
requests should lie with the Al Service Providers, as these entities are privy to the 
information being processed by the Al systems. 


It is also unclear how a user can “object” or “veto” the use of technologies or services employing 
high-risk Al. BSA proposes to provide users with the right to request reconsideration of a 
decision rendered by an Al system. 


BSA also recommends introducing exceptions to exempt Al Service Providers from 
responding to user requests in certain situations, such as when providing an explanation has a 
risk of harming another person’s health or safety or may lead to disclosure of trade secrets. This 
recognizes that the need for explainability must be considered in the context of wider policy 
interests. 


Relatedly, while the principle of explainability is widely recognized as an important factor in 
engendering trust in Al systems and solutions, there is no universal consensus on the 
circumstances where explanations should be mandatory or required. In this regard, the European 
Union’s High-Level Expert Group (HLEG) on Al acknowledged that providing an explanation for the 
quality of outcomes may not always be feasible due to technical issues and stated, “other 
explanatory measures (e.g., traceability, appreciation, transparent communications) could be 
helpful for Al systems.” 10 The HLEG also acknowledged that “[t]he degree to which explainability is 
needed depends on the context and the severity of the consequences of erroneous or otherwise 














10 Ethics Guidelines for Trustworthy Al, April 2019, https://ec.europa.eu/newsroom/dae/document.cfm?doc_id=60419 at p. 13. 
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inaccurate output to human life.” 11 


BSA further recommends that the Bill should offer alternative means to give effect to the 
principle of explainability, such as the “other explanatory measures” suggested by the 
HLEG. 











CONCLUSION 


BSA works closely with governments around the world to promote the development of policies that 
encourage the responsible development and use of Al. '2 


To that end, BSA has identified five key pillars for Responsible Artificial Intelligence. These pillars 
reflect how both industry and government have important roles to play in promoting the benefits and 
mitigating the potential risks involved in the development, deployment, and use of Al: 


1. Building Confidence and Trust in Al Systems: Highlighting industry efforts to ensure Al 
systems are developed in ways that maximize fairness, accuracy, data provenance, explainability, 
and responsibility. 


2. Sound Data Innovation Policy: Promoting data policies that are conducive to the development 
of Al and other new data-driven technologies including reliable legal mechanisms that facilitate 
cross-border data transfers, legal certainty for value-added services (e.g., text and data mining, 
machine learning), and enhanced access to non-sensitive government data. 


3. Cybersecurity and Privacy Protection: Advocating for policies that strengthen enhanced 
security measures and respect informed consumer choices while ensuring the ability to deliver 
valuable tailored products and services. 


4. Research and Development: Supporting investment in efforts that foster confidence and trust in 
Al systems, promote coordination and collaboration between industry and government, and help 
grow the Al workforce pipeline. 


5. Workforce Development: Identifying opportunities for government and industry to collaborate on 
initiatives to prepare the workforce for the jobs of the future. 


BSA acknowledges both the importance of Al and the risks associated with certain uses of the 
technology. In response to the risk of bias, BSA published a report titled “Confronting Bias: BSA’s 
Framework to Build Trust in Al” 1° to provide a guide that organizations can use to perform impact 
assessments to identify and mitigate risks of bias that may emerge throughout an Al system’s 
lifecycle. 





11 Assessment List for Trustworthy Al (ALTAI), July 2020, https://ec.europa.eu/newsroom/dae/document.cfm?doc_id=68342 at 
p.15. 





12 BSA Al Policy Overview, accessible at httos://ai.bsa.org/ 


13 Confronting Bias: BSA’s Framework to Build Trust in Al, June 2021, https://ai.bsa.org/wp- 
content/uploads/2021/06/2021bsaaibias.pdf. 
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BSA appreciates the opportunity to comment on the Bill to establish an ‘Act on Algorithm and Al’. We 
hope this submission is useful to the consultation process. Please let us know if you have any 
questions or would like to discuss comments in more details(geunk@bsa.org). 


Geun Kim 
Country Manager Korea 


BSA | THE SOFTWARE ALLIANCE 
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